News for hackers. Stuff that matters.

A comment on Show HN: Knockles – eBPF Port Knocking Tool.

Re:Show HN: Knockles – eBPF Port Knocking Tool by cryptonector on Monday August 29, 2022 @11:28AM (#32639434)
From TFA:

  -    A single SYN request is sent on an opened || closed port  
  -    It carries an OTP for authentication so you can be the only one to open a port 
  -    Once authentified, a random (HMAC based) port is opened for a TCP connection 
  -    Then, the port is closed as soon as a connection has been established
Very clever. The fake SYN carries data, an OTP. Very nice!
[ Parent | on HN ]
Re:Show HN: Knockles – eBPF Port Knocking Tool by nousermane on Monday August 29, 2022 @03:05PM (#32642166)
Clever, yes. But this will break in presence of middle-boxen that rewrite IP-ID [1] and/or TCP-SEQ/ACK [2] numbers (SSL inspection firewalls, WAN optimizers, older satellite modems, even some particularly bad carrier-grade NAT devices).

[1] https://en.wikipedia.org/wiki/IPv4#Identification

[2] https://en.wikipedia.org/wiki/Transmission_Control_Protocol#...

[ Parent | on HN ]
Re:Show HN: Knockles – eBPF Port Knocking Tool by cryptonector on Monday August 29, 2022 @03:52PM (#32642731)
Yes, putting the HMAC in the IP ID field is brittle.

Maybe a TCP option could be used.

[ Parent | on HN ]
Re:Show HN: Knockles – eBPF Port Knocking Tool by jmprspret on Tuesday August 30, 2022 @10:06AM (#32650639)
Can't all that be done without eBPF in a normal userspace program?
[ Parent | on HN ]
Re:Show HN: Knockles – eBPF Port Knocking Tool by cryptonector on Tuesday August 30, 2022 @11:50AM (#32651815)
Yes, using SOCK_RAW.
[ Parent | on HN ]